Add GitHub Package Registry as second default feed

[mast-eu]

This is necessary, since we plan to publish our own packages (including PM updates) on GitHub.

[maraf]

@mast-eu Do we already have the URL?

[mast-eu]

Should be https://nuget.pkg.github.com/gitextensions/index.json.

Source: https://help.github.com/en/articles/configuring-nuget-for-use-with-github-package-registry#installing-a-package

[mast-eu]

Thinking about the security concerns that emerged in #20 (comment), it would be nice if all core plugins would be somehow marked and are updatable only through the GH package registry. Since this is under our control, we can easily avoid name conflicts.

On the other hand, community plugins can be updated through any feed, with nuget.org being pre-configured. The user may add as many additional feeds as he likes, but than it is within his own responsibility to avoid/resolve potential conflicts with the same package being available on multiple feeds.

[maraf]

NuGet recently announced package signing, maybe it could help us somehow. Otherwise we have to create a list of core plugins. Or use convention that GitExtensions.* can be installed only from the GH feed.

[maraf]

@mast-eu GH feed requires authentication. Don't you if it's configured by us or it's required?

[mast-eu]

As I understand it, authentication is only needed for publishing or deleting a package (i.e. for write access), but not for read access.

[RussKie]

Have a look here - https://ci.appveyor.com/project/gitextensions/gitextensions-pluginmanager/settings/nuget

[mast-eu]

Remember to revert #24 when implementing this.

[mast-eu]

Closing as obsolete.

We decided to not to use GitHub Package Registry, because it requires authentication even for downloading packages.
We might re-evaluate this if the need for authentication gets removed.